EUVD-2026-35083
GHSA-4fp7-72xg-c4hc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Primary rating from Vendor (imaginationtech) · only source for this CVE.
CVSS VectorVendor: imaginationtech
Lifecycle Timeline
3DescriptionCVE.org
Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of a mapping state maintained for a sparse memory allocation.
The product accidentally refers to the wrong memory due to the semantics of how math operations are implicitly scaled across buffers of different sizes.
AnalysisAI
Local privilege escalation and integrity compromise in Imagination Technologies Graphics DDK (GPU driver) allows non-privileged users to corrupt sparse memory mapping state via improper GPU system calls, leading to out-of-bounds memory access. The flaw stems from implicit scaling errors in pointer arithmetic across buffers of differing sizes (CWE-468), affecting DDK releases 24.2 RTM, 25.1-25.3 RTM, and 26.1 RTM. No public exploit identified at time of analysis, but the local attack vector with low complexity makes this attractive for sandbox escape chains on Android/Linux devices using PowerVR GPUs.
Technical ContextAI
The Imagination Graphics DDK is the kernel-mode driver stack for PowerVR GPUs, widely deployed in mobile SoCs (MediaTek, Allwinner, TI) running Android and embedded Linux. The vulnerability is a CWE-468 Incorrect Pointer Scaling weakness: when the driver performs arithmetic on pointers tied to sparse memory allocations, the compiler/runtime implicitly multiplies the offset by the element size of the source buffer rather than the intended target buffer. This produces an off-by-many-bytes reference into adjacent kernel-managed mapping metadata, allowing a userland process holding a GPU file descriptor (typically /dev/dri/* or vendor GPU node - accessible to any app on Android) to desynchronize the kernel's view of which physical pages back which virtual mappings.
RemediationAI
Patch available per vendor advisory at https://www.imaginationtech.com/gpu-driver-vulnerabilities/ - exact fixed DDK version is not stated in the provided data, so administrators must consult the vendor page directly and confirm with their SoC vendor or Android OEM, since DDK fixes propagate through BSP updates rather than direct end-user installs. Until a fixed DDK build is integrated into device firmware, compensating controls are limited because GPU device nodes are required for normal graphics rendering; on managed Android fleets consider restricting installation of untrusted third-party apps via MDM (which removes the local attacker), disabling GPU compute APIs (OpenCL/Vulkan compute) for non-essential apps where the OS permits, and on Linux embedded devices tightening udev permissions on /dev/dri/render* to a dedicated group rather than world-accessible - note that restricting render node access will break hardware-accelerated graphics for any user not in the group.
More in Graphics Ddk
View allMemory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to expl
Out-of-bounds write in the Imagination Technologies Graphics DDK (GPU user-space driver) can be triggered when a victim
GPU shader compiler memory corruption via malicious shader code allows remote code execution when the compiler runs with
Out-of-bounds kernel write in Imagination Technologies Graphics DDK (PowerVR GPU driver) allows a local non-privileged p
Out-of-bounds kernel memory read/write in Imagination Technologies Graphics DDK (the driver kit for PowerVR GPUs) allows
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Envir
Local memory-corruption escalation in Imagination Technologies' Graphics DDK (the PowerVR GPU driver stack) lets an unpr
Local privilege escalation in Imagination Technologies' Graphics DDK (PowerVR GPU driver) lets a non-privileged user tri
Privilege escalation in Imagination Technologies Graphics DDK allows guest VM kernel software to issue crafted commands
Privilege escalation in Imagination Technologies' Graphics DDK GPU driver allows kernel-level software inside a Host VM
Kernel heap corruption in Imagination Technologies Graphics DDK enables local privilege escalation from a non-privileged
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafte
Same weakness CWE-468 – Incorrect Pointer Scaling
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today